Cyber Essentials certification expires twelve months from the date it was issued. For many UK SMEs, that expiry lands in late summer, and the timing of your renewal can make the difference between a smooth recertification and a rushed scramble.

This article looks at when August and September renewals typically occur, how long the process takes, and what the Danzell update (Cyber Essentials v3.3, released April 2026) means for your preparation.

Why August and September Matter for Cyber Essentials Renewals

August and September sit at a natural inflection point for SME renewal cycles. Roughly a third of all active certifications expire between July and September each year, according to industry patterns observed across IASME assessment providers.

There are two practical consequences of this timing:

• Increased demand on assessment providers. Assessor queues lengthen during peak months, extending review times by up to two weeks.

• Internal resource competition. End-of-financial-year reporting overlaps with renewal preparation, stretching your team thin.

If you are planning a renewal for August or September, this guide walks you through the optimal timing, preparation steps, and what the latest IASME changes mean for your process.

When Exactly Should You Start Preparing?

The short answer is eight to ten weeks before your certificate expires. Here is why that window exists.

The 8-Week Timeline Explained

Each step in the renewal process has its own timeline:

• SAQ completion: Typically 5 to 10 business days, depending on how many devices and controls you need to document.

• Assessor review: Usually 5 to 10 business days, though this extends during peak months (August-September).

• Certificate issuance: Issued immediately upon successful review, so this step is instant once the assessor approves.

Working backwards ten weeks from your expiry date gives you a comfortable buffer for unexpected delays, additional assessor queries, or remediation work.

Why Waiting Until the Last Week Is Risky

If you leave your renewal until the final week before expiry, you risk:

• Certificate gap. If your current certification lapses before the new one is issued, you effectively lose coverage. Some insurers treat this gap as a compliance failure, which can affect your policy terms.

• Assessor unavailability. Peak-season assessor queues mean you may wait longer than expected for review. Starting early secures your place in the queue.

• Incomplete SAQ submissions. Rushed questionnaires contain more errors, which triggers assessor queries and extends the timeline further.

The sweet spot is ten weeks before expiry. That gives you enough time to address gaps without feeling the pressure of an approaching deadline.

Finding Your Expiry Date

Your certificate expiry date is logged in two places: the IASME portal under your organisation's account, and the certificate PDF that was emailed when you first achieved certification. Note this date on your calendar and set a reminder for ten weeks before that point.

Steps for a Smooth Renewal

The most effective preparation starts before you open the SAQ. Here is a practical sequence:

1. Check your certificate expiry date. Log in to the IASME portal and note the exact date. Work backwards ten weeks from that point and mark it as your renewal start date.

2. Run an internal security audit. Before touching the SAQ, check that your core controls are in place: firewalls, secure configuration, access control, malware protection, and security updates.

3. Complete the SAQ. Use the IASME portal to fill in your organisation's details and control evidence. Be thorough but concise.

4. Submit to your assessor. Once the SAQ is complete, submit it through the portal and await review.

5. Respond to queries promptly. When the assessor raises queries, respond within the timeframe they specify to keep the process on track.

If you need support navigating the process or want a pre-assessment health check, explore our resources page.

The Danzell Update (v3.3) and What It Means for Renewals

IASME introduced version 3.3 of the Cyber Essentials requirements document, internally known as the Danzell update. This version is mandatory for all assessment accounts created after April 2026, and it applies to renewals processed through those accounts.

The key changes in v3.3 include:

• Expanded scope for security updates. The requirement now covers all devices that connect to your network, including IoT and mobile endpoints.

• Stronger data protection language. Where v3.2 used 'should' in several areas, v3.3 uses 'must' for encryption of data at rest and in transit.

• Clearer asset management expectations. You now need to maintain an up-to-date inventory of all network-connected devices, not just core infrastructure.

Comparing v3.2 (Willow) vs v3.3: What Changes?

Some SMEs worry that the transition from v3.2 (Willow) to v3.3 (Danzell) means starting from scratch. It does not.

Your existing controls likely cover most of the new requirements. The main differences are in specificity and scope rather than fundamental philosophy. Where v3.2 said 'you should have security updates,' v3.3 says 'you must maintain an automated patch management process across all endpoints.'

The practical impact is usually additional documentation rather than new technology investments. Review your existing policies against the v3.3 requirements, update your asset inventory, and ensure your patch management process is clearly documented.

Common Renewal Pitfalls and How to Avoid Them

Even with good timing, renewals can stall. The most common causes are:

• Incomplete SAQs. Rushed questionnaires with missing documentation force assessors to request clarifications, adding days or weeks to the process.

• Outdated asset inventories. If your device list doesn't match reality, assessors flag discrepancies that delay approval.

• Gap remediation delays. Discovering missing controls at the SAQ stage, rather than during your internal audit, extends the timeline.

Address these proactively. Run a mock assessment against v3.3 criteria before submitting your SAQ, and keep your asset inventory updated throughout the year, not just at renewal time.

How Much Does Cyber Essentials Renewal Cost?

Costs vary depending on whether you pursue self-assessment (Cyber Essentials) or an assessor-verified route (Cyber Essentials Plus). Self-assessment typically costs between £300 and £500, while Cyber Essentials Plus ranges from £700 to £1,200 depending on organisation size.

Some SMEs bundle renewal with broader IT advisory services, which can reduce effective costs through package pricing.

Frequently Asked Questions

Can I renew Cyber Essentials before my current certificate expires?

Yes. You can start the renewal process at any time, but your new certificate will only be valid from the date it is issued, not retroactively. Starting early means you maintain continuous coverage.

Does Cyber Essentials require an annual renewal?

Yes. The certification is valid for twelve months from the date of issue, and you must renew before that date to maintain compliance.

What is the cost of Cyber Essentials renewal?

Costs vary depending on whether you pursue self-assessment (Cyber Essentials) or an assessor-verified route (Cyber Essentials Plus). Self-assessment typically costs between £300 and £500, while Cyber Essentials Plus ranges from £700 to £1,200 depending on organisation size.

Can I switch assessment providers for my renewal?

Yes. You are not tied to the provider you used for your initial certification. Some organisations switch providers to get better service levels, faster turnaround, or additional advisory support.

How long does it take to renew Cyber Essentials?

From SAQ submission to certificate receipt, the process typically takes four to six weeks. During peak months (August-September), allow an additional two weeks for assessor availability.

Ready to Renew?

If your Cyber Essentials certification is due in August or September, now is the time to act. Start your preparation ten weeks before expiry, address any gaps proactively, and book your assessor early to avoid peak-period delays.

Contact Infinite Cloud IT for a pre-assessment review or to discuss how our managed IT services can help you maintain continuous compliance.